External risk intelligence

IBM WebSphere Application Server Unsafe Deserialization Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-14974

IBM WebSphere Application Server is commonly deployed as an internet-facing application server, web middleware, or API gateway to host enterprise applications, making its network services frequently reachable from the public internet in standard deployment patterns.

Deserialization

Ibm Websphere Application Server

8.5.0.0 to before 8.5.5.319.0.0.0 to before 9.0.5.29

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in IBM WebSphere Application Server that could allow attackers to execute arbitrary code by exploiting unsafe data handling. The vulnerability's network-accessible nature and potential for code execution mean it warrants attention for any organization using the affected technology.

Unsafe data handling allows code execution.
Critical vulnerability in common IBM middleware.
Confirm relevance and exposure for WebSphere.

Attack Path

How an attacker could exploit the issue

An attacker could reach IBM WebSphere Application Server by exploiting its network-facing services, which are often exposed to the internet. By sending specially crafted, untrusted data that undergoes unsafe deserialization, the attacker can trigger the vulnerability. This process can lead to the execution of arbitrary code on the server.

No special access required.
Unsafe deserialization of untrusted data.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

IBM WebSphere Application Server, when processing untrusted data, could allow a remote attacker to execute arbitrary code due to unsafe deserialization. This vulnerability could affect the integrity and availability of the application server and any applications it hosts.

Application server code integrity.
Unsafe deserialization of untrusted data.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for maintaining IBM WebSphere Application Server, such as infrastructure or platform teams, should lead the response to this critical vulnerability. The initial step involves locating all instances of the affected WebSphere Application Server, assessing their exposure and business criticality, identifying the accountable application or system owner, and then developing a remediation plan based on the identified risks.

Infrastructure and platform teams own resolution.
Verify external reachability and critical systems first.
Plan remediation based on validated exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM WebSphere Application Server?

IBM WebSphere Application Server is a software framework used to host enterprise-level Java applications. It acts as middleware, managing communication between web browsers and backend databases or services. Organizations rely on it to run critical business logic, APIs, and web portals, making it a foundational component of many corporate network infrastructures.

How does CVE-2026-14974 cause code execution?

This vulnerability involves a weakness called unsafe deserialization, identified as CWE-502. Deserialization is the process of converting stored data back into an active object. If the software trusts this data without validation, an attacker can provide malicious, specially crafted input that the server inadvertently executes as commands, leading to full unauthorized code execution.

What triggers this vulnerability in WebSphere?

The vulnerability is triggered when the application server receives and processes untrusted data sent over the network. It does not require an attacker to have prior access, user credentials, or specific privileges. Simply interacting with the vulnerable network-facing service using malicious data is sufficient to initiate the flaw; it is not triggered by standard, legitimate application traffic.

Do I need to worry if my server is internal?

Yes, but priority varies. According to Halo Surface Signal, this software is commonly deployed as an internet-facing gateway, which significantly increases risk. While internal-only instances have a smaller attack surface, they remain susceptible if an attacker gains entry to your network. Assess all instances to determine which are reachable from the public internet versus those shielded by internal network controls.

How should I respond to this threat?

Begin by creating a comprehensive inventory of your environment to locate all running instances of IBM WebSphere Application Server. Once identified, map these assets against the affected versions listed in this advisory. Prioritize your most critical, internet-facing systems for review, verify who owns each application, and coordinate with your infrastructure team to develop a structured patching or update plan.

References

www.ibm.com/support/pages/node/7281641

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.